IBM STREAMS 4.1.1.1 and 4.1.1.2  JOBS DO NOT INHERIT THE ENVIRONMENT VARIABLES SET IN .BASHRC, WHEN STREAMS IS RUN AS A SYSTEM SERVICE - United States  FLASH (ALERT)

ABSTRACT
 In Streams 4.1.1.1 and 4.1.1.2 Streams jobs may not pick up the user enviroment from the streams user's .bashrc. This behavior is different from earlier releases. With these versions, when Streams is run as a system service, application environment variables must be set with streamtool.

CONTENT
Problem Description
When running Streams as a system service with Streams releases 4.1.1.1
or 4.1.1.2, toolkits and user applications that depend on the
user environment may have various errors.
For example the database toolkit might show the following error
if it does not pick up the ODBCINI environment variable:

 * "An SQL operation failed. The SQL state is 08003, the SQL code
   is 0 and the SQL message is [unixODBC][Driver
   Manager]Connnection does not exist."
 *

Problem Solution

To work around the issue, set environment variables that are needed by the application directly in the instance with:  *

 * streamtool setproperty
 * -d <domain> -i <instance>
   --application-ev <VARIABLE NAME>=<VARIABLE VALUE>
 *

RELATED INFORMATION
 APAR IT18432 [https://www-01.ibm.com/support/entdocview.wss?uid=swg1IT18432]

Question:
User environment variables no longer getting picked up after upgrade to 4.1.1.1 or 4.1.1.2?

Have you found that after upgrade to Streams 4.1.1.1 or 4.1.1.2, that environment variables set in your .bashrc are no longer being set? For example ODBCINI is not set for the database toolkit and you get

     An SQL operation failed. The SQL state is 08003, the SQL code
     is 0 and the SQL message is [unixODBC][Driver
     Manager]Connnection does not exist.

Answer:
To work around the issue, set environment variables that are needed by the application directly in the instance with:  *

 * streamtool setproperty
 * -d <domain> -i <instance>
   --application-ev <VARIABLE NAME>=<VARIABLE VALUE>


IBM Exit() action within User Defined Function in Impact Policy Language - United States netcool; impact; netcool/impact; nci; ipl; policy; language; exit; exit(); function; user; defined; custom; udf; parser; action; set; global; variable; var; get; setglobalvar; getglobalvar; globalvar TECHNOTE (FAQ)

QUESTION
 and how to exit the Policy process from within a Custom Function

CAUSE
Using the Exit() parser function within a User Defined (or Custom) Function in Impact Policy Language (IPL) will not exit the Policy process, it will only exit the User Defined Function.

ANSWER
This is because the Exit() parser function in IPL is designed to exit the immediate scope. To carry the action outside of the User Defined Function to the Policy level one would have to set a variable that is then tested immediately after the User Defined Function call - for example:

 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 * SetGlobalVar("ExitNow", 1);
 *
 * Exit();
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 * SetGlobalVar("ExitNow", 1);
 *
 * Exit();
 *
 *
 *
 *
 *
 *
 *
 *
 *
 *
 * If(GetGlobalVar("ExitNow") == 1)
 *
 * {
   Log(ID+WP+": Existing policy...");

 * Exit
 * ();
   }

The above example ties in somewhat with the exampled configuration from the TechNote "Event Flagging with Go_NoGo checking" [ link below] and uses structured logging as covered in the TechNote "Structured logging in Policies" [ link below].

If the User Defined Function was nested within another User Defined Function one would have to exit each layer to return the Policy layer before the Exit() action would exit the Policy.
RELATED INFORMATION
 Event Flagging with Go_NoGo checking [http://www-01.ibm.com/support/docview.wss?uid=swg21675015]
Structured Logging in Policies [http://www-01.ibm.com/support/docview.wss?uid=swg21596180]

Question:
Netcool/Impact (all versions): How is the Exit() action function expected to work with User Defined Functions? Netcool/Impact (all versions)

Using the Exit() action function within a User Defined Function in a Policy will not exit the Policy process.

Answer: This is because the Exit() parser function in IPL is designed to exit the immediate scope. To carry the action outside of the User Defined Function to the Policy level one would have to set a variable that is then tested immediately after the User Defined Function call


IBM Guide to properly setting up SSL within the IBM HTTP Server - United States ssl; handshake; secure socket layer; handshake failed; enable; ssl config; ssl setup; setup; IHS; crl; revocation; ssl; ssl; ssl; configure; config; config; config TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 The following information can be used as a guide for setting up the Secure Sockets Layer (SSL) within the IBM HTTP Server. This document covers information on setting up SSL virtualhosts, creating keyfiles, certificates along with how to protect access to directories and URLs to specific ciphers. Also, included is documentation on how to trace and record SSL traffic between a client browser and the Web server.

RESOLVING THE PROBLEM
The following steps help guide you through the proper set up of SSL within the IBM HTTP Server:

 1. Confirm that the Global Security Kit (GSKit) is installed and meets the minimum requirements

 2. Create a key database file and certificates needed to authenticate the Web server during an SSL handshake

 3. Enable SSL directives within the IBM HTTP Server configuration file (httpd.conf)

 4. Other considerations when enabling SSL directives within the IBM HTTP Server configuration file (httpd.conf)

 5. Information that IBM WebSphere® Support needs to debug SSL configuration and certificate issues related to the IBM HTTP Server

 1. Confirm that the Global Security Kit is installed and meets the minimum requirements

    The Global Security Kit (GSKit) is a required component for the Secure Sockets Layer (SSL) enablement within the IBM HTTP Server. Therefore, it is important to confirm that a supported version of the Global Security Kit is installed prior to enabling SSL.

    For a complete listing of IBM HTTP Server releases and corresponding Global Security Kit versions, click IBM HTTP Server: Global Security Kit (GSKit) supported versions [http://www.ibm.com/support/docview.wss?rs=177&context=SSEQTJ&uid=swg21173214].

 2. Create a key database file and certificates needed to authenticate the Web server during an SSL handshake

    The iKeyman GUI, which is included within the IBM HTTP Server distribution, can be used to create a key database file (for example: key.kdb) needed to store personal server certificates required by the client browser during an SSL handshake.

    For quick information on how to create a key database file and personal server certificates, refer to the technote IKEYMAN, How do I...? [http://www.ibm.com/support/docview.wss?rs=177&context=SSEQTJ&uid=swg21006430]

    More extensive information on using the iKeyman GUI to create key database files and certificates is located here:  * For releases of IBM HTTP Server v7.0 [http://pic.dhe.ibm.com/infocenter/wasinfo/v7r0/index.jsp?topic=%2Fcom.ibm.websphere.ihs.doc%2Finfo%2Fihs%2Fihs%2Fwelc_ikeymangui.html]
     * For releases of IBM HTTP Server v8.0 [http://pic.dhe.ibm.com/infocenter/wasinfo/v8r0/index.jsp?topic=%2Fcom.ibm.websphere.ihs.doc%2Finfo%2Fihs%2Fihs%2Fwelc_ikeymangui.html]
     * For releases of IBM HTTP Server v8.5 [http://www-01.ibm.com/support/knowledgecenter/SSD28V_8.5.5/com.ibm.websphere.ihs.doc/ihs/welc_ikeymangui.html]
     * For releases of IBM HTTP Server v9.0 [https://www.ibm.com/support/knowledgecenter/SSAW57_9.0.0/com.ibm.websphere.ihs.doc/ihs/welc_ikeymangui.html]

 3. Enable SSL directives within the IBM HTTP Server's configuration file (httpd.conf)
     1. Verify that the SSL modules are uncommented
         * For Microsoft® Windows®:

           LoadModule ibm_ssl_module modules/mod_ibm_ssl.so [/support/docview.wss?uid=swg21179559&aid=1]

         * For UNIX® platforms:

           LoadModule ibm_ssl_module modules/mod_ibm_ssl.so [/support/docview.wss?uid=swg21179559&aid=2]

     2. Create an SSL virtualhost stanza using the following examples and directives

        If you are enabling one Web site for SSL, and the hostname is the same as the one already defined in the Global Scope for non-SSL (port 80), you can enable SSL as follows. This virtualhost uses the default hostname defined by the ServerName directive in the Global Scope and the IP address associated with it.

        http://www.mycompany.com (non-SSL) 192.168.1.102 https://www.mycompany.com (SSL) 192.168.1.102

        Example 1:

        Listen 80
        ServerName www.mycompany.com

        <Directory "c:/Program Files/IBM HTTP Server/htdocs">
        Options Indexes
        AllowOverride None
        order allow,deny
        allow from all
        </Directory>

        DocumentRoot "c:/program files/ibm http server/htdocs"
        DirectoryIndex index.html

        Listen 443
        <VirtualHost :443>
        SSLEnable
        SSLClientAuth None
        </VirtualHost>

        SSLDisable
        KeyFile "c:/program files/ibm http server/key.kdb"
        SSLV2Timeout 100
        SSLV3Timeout 1000 [/support/docview.wss?uid=swg21179559&aid=3]

        If you are enabling one Web site for SSL and the ServerName is different than the ServerName already defined in the Global Scope for non-SSL (port 80), you can enable SSL as follows. Both hostnames must be registered in DNS to a separate IP address, and both IP addresses must be configured on local network interface cards.

        http://www.mycompany.com (non-SSL) 192.168.1.102 http://www.mycompany2.com (non-SSL) 192.168.1.103 https://www.mycompany2.com (SSL) 192.168.1.103

        Example 2:

        Listen 80
        ServerName www.mycompany.com

        <Directory "c:/Program Files/IBM HTTP Server/htdocs">
        Options Indexes
        AllowOverride None
        order allow,deny
        allow from all
        </Directory>

        DocumentRoot "c:/program files/ibm http server/htdocs"
        DirectoryIndex index.html

        <VirtualHost 192.168.1.103:80>
        ServerName www.mycompany2.com
        <Directory "c:/Program Files/IBM HTTP Server/htdocs2">
        Options Indexes
        AllowOverride None
        order allow,deny
        allow from all
        </Directory>
        DocumentRoot "c:/program files/ibm http server/htdocs2"
        DirectoryIndex index2.html
        </VirtualHost>

        Listen 443
        <VirtualHost 192.168.1.103:443>
        ServerName www.mycompany2.com
        SSLEnable
        SSLClientAuth None
        <Directory "c:/Program Files/IBM HTTP Server/htdocs2">
        Options Indexes
        AllowOverride None
        order allow,deny
        allow from all
        </Directory>
        DocumentRoot "c:/program files/ibm http server/htdocs2"
        DirectoryIndex index2.html
        </VirtualHost>

        SSLDisable
        KeyFile "c:/program files/ibm http server/key.kdb"
        SSLV2Timeout 100
        SSLV3Timeout 1000
        If you are enabling multiple Web sites for SSL, you can enable SSL as follows. All hostnames must be registered in DNS to a separate IP address. Also, all the IP addresses must be configured on a local network interface card. You must use the SSLServerCert directive to identify which personal server certificate in the key database file is passed to the client browser during the SSL handshake for each Web site. If the SSLServerCert directive is not defined, the IBM HTTP Server passes whatever certificate in the key database file is marked(*) as the "default key".

        For more information on why different IP addresses are required when enabling multiple Web sites for SSL: IP-Based Virtual Hosting must be used if configuring multiple SSL Virtual Host [http://www.ibm.com/support/docview.wss?rs=177&context=SSEQTJ&uid=swg21045922]http://www.mycompany.com (non-SSL) 192.168.1.102 https://www.mycompany.com (non-SSL) 192.168.1.102 http://www.mycompany2.com (non-SSL) 192.168.1.103 https://www.mycompany2.com (SSL) 192.168.1.103 http://www.mycompany3.com (non-SSL) 192.168.1.104 https://www.mycompany3.com (SSL) 192.168.1.104

        Example 3:

        Listen 80
        ServerName www.mycompany.com

        <Directory "c:/Program Files/IBM HTTP Server/htdocs">
        Options Indexes
        AllowOverride None
        order allow,deny
        allow from all
        </Directory>

        DocumentRoot "c:/program files/ibm http server/htdocs"
        DirectoryIndex index.html

        <VirtualHost 192.168.1.103:80>
        ServerName www.mycompany2.com
        <Directory "c:/Program Files/IBM HTTP Server/htdocs2">
        Options Indexes
        AllowOverride None
        order allow,deny
        allow from all
        </Directory>
        DocumentRoot "c:/program files/ibm http server/htdocs2"
        DirectoryIndex index2.html
        </VirtualHost>

        <VirtualHost 192.168.1.104:80>
        ServerName www.mycompany3.com
        <Directory "c:/Program Files/IBM HTTP Server/htdocs3">
        Options Indexes
        AllowOverride None
        order allow,deny
        allow from all
        </Directory>
        DocumentRoot "c:/program files/ibm http server/htdocs3"
        DirectoryIndex index3.html
        </VirtualHost>

        Listen 443
        <VirtualHost 192.168.1.102:443>
        ServerName www.mycompany.com
        SSLEnable
        SSLClientAuth None
        SSLServerCert mycompany
        <Directory "c:/Program Files/IBM HTTP Server/htdocs">
        Options Indexes
        AllowOverride None
        order allow,deny
        allow from all
        </Directory>
        DocumentRoot "c:/program files/ibm http server/htdocs"
        DirectoryIndex index.html
        </VirtualHost>

        <VirtualHost 192.168.1.103:443>
        ServerName www.mycompany2.com
        SSLEnable
        SSLClientAuth None
        SSLServerCert mycompany2
        <Directory "c:/Program Files/IBM HTTP Server/htdocs2">
        Options Indexes
        AllowOverride None
        order allow,deny
        allow from all
        </Directory>
        DocumentRoot "c:/program files/ibm http server/htdocs2"
        DirectoryIndex index2.html
        </VirtualHost>

        <VirtualHost 192.168.1.104:443>
        ServerName www.mycompany3.com
        SSLEnable
        SSLClientAuth None
        SSLServerCert mycompany3
        <Directory "c:/Program Files/IBM HTTP Server/htdocs3">
        Options Indexes
        AllowOverride None
        order allow,deny
        allow from all
        </Directory>
        DocumentRoot "c:/program files/ibm http server/htdocs3"
        DirectoryIndex index3.html
        </VirtualHost>

        SSLDisable
        KeyFile "c:/program files/ibm http server/key.kdb"
        SSLV2Timeout 100
        SSLV3Timeout 1000

 4. Other considerations when enabling SSL directives within the IBM HTTP Server configuration file (httpd.conf).

     * How to rewrite HTTP (port 80) requests to HTTPS (port 443)
       The rewrite module (mod_rewrite.c) provided with the IBM HTTP Server can be used as an effective way to automatically rewrite all HTTP requests to HTTPS. For complete information click How to rewrite HTTP (port 80) requests to HTTPS (port 443) [http://www.ibm.com/support/docview.wss?rs=177&context=SSEQTJ&uid=swg21114864].

     * Logging SSL request information in the access log for IBM HTTP Server
       The IBM HTTP Server implementation provides Secure Sockets Layer (SSL) environment variables that are configurable with the LogFormat directive in httpd.conf. For complete information click Logging SSL request information in the access log for IBM HTTP Server [http://www.ibm.com/support/docview.wss?rs=177&context=SSEQTJ&uid=swg21176455].

     * Enabling Certificate Revocation Lists (CRL) in the IBM HTTP Server
       Certificate revocation provides the ability to revoke a client certificate given to the IBM HTTP Server by the browser when the key is compromised or when access permission to the key is revoked. CRL represents a database that contains a list of certificates revoked before their scheduled expiration date. For complete information:  * For releases of IBM HTTP Server v7.0 [http://pic.dhe.ibm.com/infocenter/wasinfo/v7r0/index.jsp?topic=%2Fcom.ibm.websphere.ihs.doc%2Finfo%2Fihs%2Fihs%2Fcihs_crlinssl.html]
        * For releases of IBM HTTP Server v8.5 [http://www-01.ibm.com/support/knowledgecenter/SSD28V_8.5.5/com.ibm.websphere.ihs.doc/ihs/cihs_crlinssl.html]
        * For releases of IBM HTTP Server v8.0 [http://pic.dhe.ibm.com/infocenter/wasinfo/v8r0/index.jsp?topic=%2Fcom.ibm.websphere.ihs.doc%2Finfo%2Fihs%2Fihs%2Fcihs_crlinssl.html]

 5. Information that IBM WebSphere Support needs to debug SSL configuration and certificate issues related to the IBM HTTP Server
     * MustGather: SSL handshake and configuration problems [http://www.ibm.com/support/docview.wss?rs=177&context=SSEQTJ&uid=swg21141302]

     * MustGather: CMS key database (.kdb) and certificate problems [http://www.ibm.com/support/docview.wss?rs=177&context=SSEQTJ&uid=swg21141303]

 *
 * Brief description of the SSL directives discussed in this document
 *

   Listen
 *
 *
 *
 *
 * SSLEnable
 *
 *
 *
 *
 * SSLClientAuth None
 *
 *
 *
 *
 * SSLDisable
 *
 *
 *
 *
 * KeyFile
 *
 *
 *
 *
 * SSLV2Timeout
 *
 *
 *
 *
 * SSLV3Timeout
 *
 *
 *
 *
 * SSLServerCert
 *
 *
 *
 *
 * SSLCipherSpec
 *
 *
 *
 *
 * SSLCipherRequire
 *
 *
 *
 *
 *
 *
 *  For releases of IBM HTTP Server v7.0 [http://pic.dhe.ibm.com/infocenter/wasinfo/v7r0/index.jsp?topic=%2Fcom.ibm.websphere.ihs.doc%2Finfo%2Fihs%2Fihs%2Frihs_ssldirs.html] For releases of IBM HTTP Server v8.0 [http://pic.dhe.ibm.com/infocenter/wasinfo/v8r0/index.jsp?topic=%2Fcom.ibm.websphere.ihs.doc%2Finfo%2Fihs%2Fihs%2Frihs_ssldirs.html] For releases of IBM HTTP Server v8.5 [http://www-01.ibm.com/support/knowledgecenter/SSAW57_8.5.5/com.ibm.websphere.ihs.doc/ihs/rihs_ssldirs.html] For releases of IBM HTTP Server v9.0 [https://www.ibm.com/support/knowledgecenter/SSAW57_9.0.0/com.ibm.websphere.ihs.doc/ihs/rihs_ssldirs.html]

Question:
How to configure SSL mutual authentication in IBM HTTP Server?

We are running IHS v7 and our application team has a specific webservice that they require SSL mutual authentication to be enabled for at the http server. Does anyone know how to set this up on IHS? Or any documentation?

Thanks

Answer:
The following steps help guide you through the proper set up of SSL within the IBM HTTP Server:

 1. Confirm that the Global Security Kit (GSKit) is installed and meets the minimum requirements

 2. Create a key database file and certificates needed to authenticate the Web server during an SSL handshake

 3. Enable SSL directives within the IBM HTTP Server configuration file (httpd.conf)

 4. Other considerations when enabling SSL directives within the IBM HTTP Server configuration file (httpd.conf)

 5. Information that IBM WebSphere® Support needs to debug SSL configuration and certificate issues related to the IBM HTTP Server


IBM Support's Guide to Rules File Processing - United States rules; rules file; array TECHNOTE (FAQ)

QUESTION
 Support Guide : Are there any rules file examples?

ANSWER

The Netcool Technical Support Guide to rules file processing is provided as a collection of commonly used rules file techniques.

Please refer to the Netcool/OMNIbus Probe and Gateway Guide for general guidance to rules file processing.

RulesfileProcessing_SupportsGuide_30.pdf [/support/docview.wss?uid=swg21903536&aid=2]RulesfileProcessing_SupportsGuide_30.pdf [/support/docview.wss?uid=swg21903536&aid=1]

Question: What happened to load.rules FAQ example? The load.rules maths function example rules file does not appear to be available anymore?

Answer: Netcool Technical Support Guide to rules file processing is provided as a collection of commonly used rules file techniques.


IBM Security Bulletin: IBM Tivoli Network Manager IP Edition is affected by an Apache CXF vulnerability (CVE-2017-3156) - United States  SECURITY BULLETIN

SUMMARY
 Vulnerability has been addressed in the Apache CXF component of Tivoli Network Manager IP Edition.

VULNERABILITY DETAILS
CVEID: CVE-2017-3156 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3156]
DESCRIPTION: Apache CXF could provide weaker than expected security, caused by the failure to use the OAuth2 Hawk and JOSE MAC Validation code. A remote attacker could exploit this vulnerability using timing attacks to obtain sensitive information.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/130249 [https://exchange.xforce.ibmcloud.com/vulnerabilities/130249] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

AFFECTED PRODUCTS AND VERSIONS
Tivoli Network Manager IP Edition 4.1.1 (Huawei MTOSI Collector install)
Tivoli Network Manager IP Edition 4.2.0 (Huawei MTOSI Collector install)

REMEDIATION/FIXES

Product VRMF APAR Remediation/First Fix Tivoli Network Manager IP Edition 4.1.1 IV99816 Please call IBM service and reference APAR IV99816, to obtain a fix if needed for 4.1.1 release. Tivoli Network Manager IP Edition 4.2.0 IV99816 CXF 3.1.10 has been upgraded in 4.2 FixPack 3.
http://www-01.ibm.com/support/docview.wss?uid=swg24043575 [http://www-01.ibm.com/support/docview.wss?uid=swg24043575] WORKAROUNDS AND MITIGATIONS
None

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 15 September 2017 : Original Version Published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: Is ITNM exposed to Apache CXF vulnerability (CVE-2017-3156)? Is ITNM versions are affected by Apache CXF vulnerability (CVE-2017-3156), If yes then what are all the version will be affected and where I can find the details?

Answer:
CVEID: CVE-2017-3156 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3156]
DESCRIPTION: Apache CXF could provide weaker than expected security, caused by the failure to use the OAuth2 Hawk and JOSE MAC Validation code. A remote attacker could exploit this vulnerability using timing attacks to obtain sensitive information.
CVSS Base Score: 5.9
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/130249 [https://exchange.xforce.ibmcloud.com/vulnerabilities/130249] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)


IBM 2035 MQRC_NOT_AUTHORIZED Connecting to WebSphere MQ from WebSphere Application Server via CLIENT Bindings - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 This article covers the most common reasons why an application running in WebSphere Application Server receives a 2035 MQRC_NOT_AUTHORIZED error when connecting to MQ as a client over a network. Quick steps to work around the MQRC_NOT_AUTHORIZED errors during development are provided in the 'Resolving the problem' section, as well as considerations for implementing security in production environments. A summary is also provided of behavior for outbound scenarios with container-managed and component-managed security, as well as inbound behavior for listener ports and activiation specifications

SYMPTOM
JMSCMQ0001: WebSphere MQ call failed with compcode '2' ('MQCC_FAILED') reason '2035' ('MQRC_NOT_AUTHORIZED')

CAUSE
The two most likely reasons why the connection is refused by MQ are as follows:

 1. The user identifier passed across the client connection from the application server to MQ is not known on the server where the MQ queue manager is running, is not authorised to connect to MQ, or is longer than 12 characters and has been truncated.
    We discuss how this user identifier is obtained and passed over the connection in more detail below.
    For queue managers running on Windows, the following error might be seen in the MQ error logs for this scenario:
    AMQ8075: Authorization failed because the SID for entity 'wasuser' cannot be obtained.
    For UNIX no entry in the MQ error logs would be seen by default.
    See technote MQS_REPORT_NOAUTH environment variable can be used to better diagnose return code 2035 [http://www-01.ibm.com/support/docview.wss?rs=171&uid=swg21299319] for details of enabling error log entries on all platforms.
 2. The user identifier passed across the client connection from the application server to MQ is a member of the 'mqm' group on the server hosting the MQ queue manager, and a Channel Authentication Record (CHLAUTH) exists that blocks administrative access to the queue manager. WebSphere MQ configures a CHLAUTH record by default in WebSphere MQ Version 7.1 and later that blocks all MQ admins from connecting as a client to the queue manager.
    The following error in the MQ error logs would be seen for this scenario:
    AMQ9777: Channel was blocked

See the Error logs on Windows, UNIX and Linux systems [http://pic.dhe.ibm.com/infocenter/wmqv7/v7r5/topic/com.ibm.mq.tro.doc/q039560_.htm] section of the MQ Information Center for the location of the MQ error logs.
DIAGNOSING THE PROBLEM
To understand the cause of the MQRC_NOT_AUTHORIZED reason code, you need to understand what username (and password) is being used by MQ to authorise the application server.

Please note that WebSphere MQ V7.5 and earlier does not provide any out-of-the box password authentication system for client connections.
Password authentication is provided out of the box in IBM MQ V8.0. More details on the new IBM MQ V8.0 security features are available in this presentation [https://www.slideshare.net/MoragHughson/websphere-mq-v8-security-deep-dive].

For WebSphere MQ V7.5 and earlier, this means that while the understanding provided in this technote over how usernames/passwords are passed from the application server to MQ is helpful for development environments, solving the security requirements of production environments usually also requires one of the following approaches:

 * Mutual SSL/TLS authentication.
   MQ provides out-of-the-box features to authenticate a remotely attaching client using the digital certificate they provide for SSL/TLS transport security. For example by configuring an SSLPEER rule on the SVRCONN channel to match the Distinguished Name in the certificate of the WebSphere Application Server, and establishing trust in the issuer of that certificate.
 * A custom, or 3rd party supplied, WebSphere MQ Security Exit
   A security exit can be written for MQ that performs username and password authentication against a repository, such as the local operating system on the MQ server, or an LDAP repository.
   When using a security exit for authentication it is important that SSL/TLS transport security is still configured, to ensure passwords are not sent in plain text.

MCA user ID (MCAUSER) configured on the Server Connection (SVRCONN) channel If an MCAUSER is configured on the SVRCONN channel that the application server is using to connect, and no security exit or mapping Channel Authentication Record is installed, then this overrides the username provided by the application server.

It is common practice for many customers to set an MCAUSER on every SVRCONN channel, and use mutual SSL/TLS authentication exclusively for authentication.

Default behaviour when no credentials are supplied in the application server

If no credentials are supplied by the application on the createConnection call, and neither of the component managed or container managed security systems described below are configured, then WebSphere Application Server provides a blank username to MQ. This causes MQ to authorise the client based on the userid that the MQ listener is running under. In the majority of cases this is 'mqm' on UNIX/Linux systems and 'MUSR_MQADMIN' on Windows.

As these are administrative MQ users, they will be blocked by default in WebSphere MQ V7.1 and higher, with a AMQ9777 error logged in the error logs of the queue manager.

Container-managed security for outbound connections

The recommended way to configure the username and password passed to MQ by the application server for outbound connections, is to use container-managed security. Outbound connections are those created using a Connection Factory, rather than a Listener Port or Activation Specification.

Usernames of 12 characters or less are passed to MQ by the appliaction server. Usernames longer than 12 characters in length will be truncated, either during authorisation (on UNIX), or in the MQMD of messages that are sent.

Container-managed security means that the deployment descriptor, or EJB 3.0 annotations, of the application declare a resource reference with authentication type set to Container.

Then when the application looks up the Connection Factory in JNDI, it does so indirectly via the resource reference. For example an EJB 2.1 application would perform a JNDI lookup as follows, where "jms/MyResourceRef" has been declared as a resource reference in the deployment descriptor:

ConnectionFactory myCF = (ConnectionFactory)ctx.lookup("java:comp/env/jms/MyResourceRef")

An EJB 3.0 application might declare an annotated object property on the bean as follows:
@Resource(name = "jms/MyResourceRef",
authenticationType = AuthenticationType.CONTAINER)
private javax.jms.ConnectionFactory myCF;

When the application is deployed by an administrator, they bind this authentication alias to an actual Connection Factory that has been created in JNDI, and assign it a J2C authentication alias on deployment.

It is the username and password contained in this authentication alias that is then passed to MQ/JMS by the application server when the application connects. This approach puts the administrator in control of which username and password is used by each application, and prevents a different application from looking up the connection factory in JNDI directly to connect with the same username and password.

A default container-managed authentication alias can be supplied on the configuration panels in the administrative console for MQ connection factories. This default will only be used in the case that an application uses a resource reference configured for container-managed security, but the administrator has not bound it to an authentication alias during deployment. A screen shot is provided below:
[/support/docview.wss?uid=swg21636093&aid=1] [/support/docview.wss?uid=swg21636093&aid=1]

Default component-managed authentication alias for outbound connections

For cases where it is impractical to change the application to use container-managed security, or to change it to supply a username and password directly on the createConnection call, it is possible to supply a default.

This default is called the "component-managed authentication alias" and cannot be configured via the administrative console (since WebSphere Application Server Version 7.0 when it was removed from the panels MQ connection factories). The below scripting samples show how to configure it using wsadmin:

 * JACL:
   wsadmin>set cell [ $AdminConfig getid "/Cell:mycell" ]

   mycell(cells/mycell|cell.xml#Cell_1)

   wsadmin>$AdminTask listWMQConnectionFactories $cell

   MyCF(cells/mycell|resources.xml#MQConnectionFactory_1247500675104)

   wsadmin>$AdminTask modifyWMQConnectionFactory MyCF(cells/mycell|resources.xml#MQConnectionFactory_1247500675104) { -componentAuthAlias myalias }

   MyCF(cells/mycell|resources.xml#MQConnectionFactory_1247500675104)
 * Jython:
   wsadmin>cell = AdminConfig.getid("/Cell:mycell")

   wsadmin>AdminTask.listWMQConnectionFactories(cell)

   'MyCF(cells/mycell|resources.xml#MQConnectionFactory_1247500675104)'

   wsadmin>AdminTask.modifyWMQConnectionFactory('MyCF(cells/mycell|resos urces.xml#MQConnectionFactory_1247500675104)', "-componentAuthAlias myalias")

   'MyCF(cells/mycell|resources.xml#MQConnectionFactory_1247500675104)'

Authentication alias for inbound MDB connections using an activation specification For inbound connections using an activation specification an authentication alias can be specified by the administrator when deploying the application, or a default authentication alias can be specified on the activation specification via the administrative console.

Authentication alias for inbound MDB connections using a listener port

For inbound connections using a listener port, the value specified in the "Container-managed authentication alias" setting of the connection factory (seen in the above screenshot) is used.

On zOS, first the "Container-managed authentication alias" is checked and used if set, then the "Component-managed authentication alias" is checked and used it set.

RESOLVING THE PROBLEM
The simplest steps to resolve the 2035 MQRC_NOT_AUTHORIZED errors in a development environment, where full transport security is not required, are as follows:

 1. Choose a user that you want WebSphere Application Server to be authenticated as. Typically the user chosen should have authority relevant to the context of the operations required by the application running in WebSphere Application Server and no more. For example, 'mqm' or other super user is not appropriate.
 2. If this user is an MQ administrative user, then relax the Channel Authentication Record (CHLAUTH) security in MQ V7.1 or higher, so that administrative connections are not blocked on the SVRCONN channel you wish to use. An example MQSC command to do this for a SVRCONN channel called 'WAS.CLIENTS' is provided as follows:
    SET CHLAUTH('WAS.CLIENTS') TYPE(BLOCKUSER) USERLIST(ALLOWANY)
 3. Configure the SVRCONN channel to set the MCA user ID (MCAUSER) to the user you have chosen. An example MQSC command to configure a SVRCONN channel to use 'myuser' as the MCA user ID is provided as follows:
    ALTER CHL('WAS.CLIENTS') CHLTYPE(SVRCONN) MCAUSER('myuser')

The following additional considerations are important for production environments: For all production environments where transport security is required, SSL/TLS security must be configured between the application server and MQ.

In order to configure SSL/TLS transport security, you must establish the appropriate trust between the MQ queue manager and WebSphere Application Server. The application server, who initiates the SSL/TLS handshake, must always be configured to trust the certificate provided by the MQ queue manager . If the application server is configured to send a certificate to the MQ queue manager, then the queue manager must also be configured to trust it.

If trust is not correctly configured on both sides, you will encounter 2393 MQRC_SSL_INITIALIZATION_ERROR reason codes after enabling SSL/TLS on the connection.

If you do not have a security exit that performs username and password authentication, then you should configure mutual SSL/TLS authentication on your Server Connection channel to cause the queue manager to require a trusted certificate is provided by the application server. To do this you set "SSL Authentication" to "Required" in the MQ Explorer or SSLCAUTH(REQUIRED) via MQSC.

If you do have a security exit that performs username and password authentication installed in your MQ server, then configure your application to supply a username and password for validation by that security exit. The details of how to configure the username and password passed to MQ by the application server are described above in the "Diagnosing the problem" section.

All Server Connection channels that do not have SSL/TLS security applied should be disabled. Example MQSC commands to disable the SYSTEM.DEF.SVRCONN channel are provided as follows (these assume no user exists on the MQ server called 'NOAUTH'):
ALTER CHL(SYSTEM.DEF.SVRCONN) CHLTYPE(SVRCONN) MCAUSER('NOAUTH')
STOP CHL(SYSTEM.DEF.SVRCONN)

Details of how to configure the private certificate and trust of a MQ queue manager, and to enable SSL security on a Server Connection channel, see the following locations in the MQ information center:

 * To configure the certificates and trust of the MQ queue manager see the following topic:
   Configuring SSL on queue managers [http://publib.boulder.ibm.com/infocenter/wmqv7/v7r1/index.jsp?topic=%2Fcom.ibm.mq.explorer.doc%2Fe_ssl_channels.htm]
 * To configure the Server Connection channel, used by applications running in the application server to connect to MQ, see the following topic:
   Configuring SSL channels [http://publib.boulder.ibm.com/infocenter/wmqv7/v7r1/topic/com.ibm.mq.explorer.doc/e_ssl_channels.htm]

Details of how you configure trust within WebSphere Application Server, and whether the application server sends a certificate to MQ for authentication, are in the following locations in the WebSphere Application Server information center:  * To create or modify an SSL Configuration containing the appropriate SSL/TLS configuration for connecting to MQ, see the following topic:
   SSL configurations [http://www14.software.ibm.com/webapp/wsbroker/redirect?version=phil&product=was-base-dist&topic=csec_sslconfigs]
   Note that MQ requires you specify a matching Cipher Suite / Cipher Spec on both sides of the connection, as it checks the negotiated Cipher Suite matches the SSLCIPH setting on the channel after the handshake is complete. As a result the WebSphere Application Server SSL Configuration should be configured to contain only the Cipher Suite that matches the SSLCIPH setting on the Server Connection channel. See the following topic in the MQ information center for details of matching pairs:
   CipherSuite and CipherSpec name mappings for connections to a WebSphere® MQ queue manager [http://publib.boulder.ibm.com/infocenter/wmqv7/v7r1/topic/com.ibm.mq.msc.doc/xms_csecure_mapping_wmq.html]
 * To enable SSL/TLS on a client connection, and choose which SSL Configuration to use, see the "Use SSL to secure communication with Websphere MQ", "Centrally managed" and "Specific configuration" sections of the following topics on Connection Factories and Activation Specifications
   WebSphere MQ messaging provider connection factory settings [http://www14.software.ibm.com/webapp/wsbroker/redirect?version=phil&product=was-nd-dist&topic=umj_pjcfm]
   WebSphere MQ messaging provider activation specification settings [http://www14.software.ibm.com/webapp/wsbroker/redirect?version=phil&product=was-nd-dist&topic=umj_pasm]

Cross reference information Segment Product Component Platform Version Edition Application Servers WebSphere Application Server for z/OS Java Messaging Service (JMS) z/OS, OS/390 8.5, 8.0, 7.0 Business Integration WebSphere Business Monitor AIX, HP-UX, Linux, Solaris, Windows, z/OS 7.5.1, 7.5, 7.0 Advanced, Basic Business Integration WebSphere Message Broker Environment AIX, HP-UX, Linux, Solaris, Windows, z/OS 9.0, 8.0, 7.0 Business Integration WebSphere MQ Clients AIX, HP-UX, IBM i, Linux, Windows 8.0, 7.5, 7.1, 7.0

Question:
Why do I get an exception when calling MQ after migrating my BPM environment (2035 MQRC_NOT_AUTHORIZED) ?

We migrated our BPM environment from V8.0 to 8.5.7. When we attempt to call the MQ service we are getting the following exception:

     [10/16/17 13:50:05:273 AST] 0000026d SystemOut     O
     com.ibm.msg.client.jms.DetailedJMSSecurityException: JMSWMQ2013: The
     security authentication was not valid that was supplied for QueueManager
     'QM1' with connection mode 'Client' and host name 'MQ1(1414)'.
     Please check if the supplied username and password are correct on the
     QueueManager to which you are connecting.
     ...
     Caused by: com.ibm.mq.MQException: JMSCMQ0001: WebSphere MQ call failed
     with compcode '2' ('MQCC_FAILED') reason '2035' ('MQRC_NOT_AUTHORIZED').
      at
     com.ibm.msg.client.wmq.common.internal.Reason.createException(Reason.jav
     a:204)
      ... 162 more

The same MQ service is working fine in the old BPM environment. User name and password configured for the queue is correct. However, when we check the MQ logs, we observing the username is not used, instead the sys admin user seems to be used.

Answer:
Default component-managed authentication alias for outbound connections

For cases where it is impractical to change the application to use container-managed security, or to change it to supply a username and password directly on the createConnection call, it is possible to supply a default.

This default is called the "component-managed authentication alias" and cannot be configured via the administrative console (since WebSphere Application Server Version 7.0 when it was removed from the panels MQ connection factories). The below scripting samples show how to configure it using wsadmin:

 * JACL:
   wsadmin>set cell [ $AdminConfig getid "/Cell:mycell" ]

   mycell(cells/mycell|cell.xml#Cell_1)

   wsadmin>$AdminTask listWMQConnectionFactories $cell

   MyCF(cells/mycell|resources.xml#MQConnectionFactory_1247500675104)

   wsadmin>$AdminTask modifyWMQConnectionFactory MyCF(cells/mycell|resources.xml#MQConnectionFactory_1247500675104) { -componentAuthAlias myalias }

   MyCF(cells/mycell|resources.xml#MQConnectionFactory_1247500675104)
 * Jython:
   wsadmin>cell = AdminConfig.getid("/Cell:mycell")

   wsadmin>AdminTask.listWMQConnectionFactories(cell)

   'MyCF(cells/mycell|resources.xml#MQConnectionFactory_1247500675104)'

   wsadmin>AdminTask.modifyWMQConnectionFactory('MyCF(cells/mycell|resos urces.xml#MQConnectionFactory_1247500675104)', "-componentAuthAlias myalias")

   'MyCF(cells/mycell|resources.xml#MQConnectionFactory_1247500675104)'


IBM Rational Application Developer Support Policy for 64 bit technology - United States RSM; RSD; RSA; RAD; caspian64 bit; 64-bit; RAD 7 64 bit; RAD 7 OS; operating system; Rational Application Developer; X64; Windows 64 bit; supported OS; AMD; PMR #13878; 379; 000; 13878379000; 1263677; 64bit; 64 bit; 32 bit; 32bit; 32-bit; 64-bit; O/S; OS; requirements; system requirements; 8.0.3; 8.0; 7.5; v8.0.3; v7.5; v7.0; v8.0; v7.5.4; 803; windows 7; server; profile; websphere; test environment; create profile; button; greyed; Run Profile Management Tool ; disabled; IBM Software Development Kit; SDK; JRE; Program Files(x86); WAS; websphere application server; clearcase; scm; clearcase scm adapter; rational requisitepro; reqpro; heap size; jvm; max os x; os x; osx; mac TECHNOTE (FAQ)

QUESTION
 What is the support policy for using IBM Rational Application Developer for WebSphere Software, IBM Rational Software Architect, IBM Rational Software Modeler or IBM Rational Systems Developer version 7.x and 8.x with 64-bit operating systems for Microsoft Windows or Linux?

CAUSE
The 7.0.0.x, v7.5.x and v8.0 to 8.0.2 versions of these applications were not designed to take advantage of 64 bit computing and only use 32-bit technology.

ANSWER
The following IBM Rational Software version 7.x products are only supported on specified 64 bit operating systems running in 32 bit mode:

 * Rational Application Developer for WebSphere Software
 * Rational Software Architect
 * Rational Software Modeler
 * Rational Systems Developer

Similarly, Rational Application Developer (RAD) and Rational Software Architect (RSA) version 8.0 to 8.0.2 are only supported on specified 64 bit operating systems running in 32 bit mode. Rational Application Developer v8.0.3+ is available as a 64-bit application install on specified 64-bit operating systems, in addition to a 32-bit application install.
There is only one installation package. When installing RAD/RSA using IBM Installation Manager, on the Location page , if your operating system is 64-bit, then select 64-bit or 32-bit to install the product in the corresponding bit mode.

These products will be referred to generically as Rational Software Development Platform (RSDP) based products. For example, WebSphere Integration Developer v6.x/7.x is RSDP based.

Examples of some 64 bit Operating Systems:

 * Microsoft Windows XP Professional x64 Edition (running on an AMD or Intel processor)
 * Microsoft Windows 7 Professional 64-bit
 * Red Hat Linux Enterprise Server 4+ running on x86-64 bit
 * RAD 9.0 under 9.0.1 introduced support for Mac OS x - Lion 10.7 32 bit (with Oracle JDK for Mac OS X 7.0 Update 40) and Mountain Lion 10.8 - 32 bit. Likewise for RSA for WebSphere 9.0.0.1.
   RAD 9.0.1.1 introduced support for 64-bit exploit on Mac OS x Mavericks 10.9 ( with Oracle JDK for Mac OS X 7.0 Update 71)
   RSA 9.1.2 introduced support for 64-bit exploit on Mac OS X Yosemite 10.10 and OS X El Capitan 10.11 (with Oracle JDK 7.0 Update 75 for OS X)

Note: RSDP 32-bit JVM based products, do not require any additional or special set-up on a supported 64-bit operating system (O/S).
They run on the provided/supported 32-bit JVM for that RSDP product, as is.

Review the following documents for more details on the system requirements:
 * (7014264) Rational Application Developer System Requirements List [http://www.ibm.com/support/docview.wss?uid=swg27014264]
 * (7014274) Rational Software Architect Family System Requirements List [http://www.ibm.com/support/docview.wss?uid=swg27014274]
 * (7014269) Rational Software Modeler System Requirements List [http://www.ibm.com/support/docview.wss?uid=swg27014269]

The above items such as the Rational Application Developer System Requirements List cover latest versions and operating systems such as Windows Vista and Windows 7. Support is limited to 32 bit mode on 64 bit operating systems on all versions prior to Rational Application Developer 8.0.3. For more information consult:
Known problems and limitations to installing 64-bit Rational Application Developer [http://www.ibm.com/support/docview.wss?uid=swg21499482]
as referred to by the above Rational Application Developer System Requirements List. The following technote:
- Benefits, requirements, limitations, and known issues for Rational Software Architect products running as 64-bit applications starting from v8.0.3 [http://www-01.ibm.com/support/docview.wss?uid=swg27021665]
, especially Benefits, describes what is possible with a larger heap size with the 64-bit JVM.

In deciding if you want a 64-bit install of RAD/RSA, it is useful to know that the ClearCase SCM Adapter and the Rational RequisitePro integration features/plugins are not supported or provided. These are only available as 32-bit eclipse plugins.

If you have any further questions, contact IBM Support for Rational Application Developer, or the appropriate IBM RSDP product support team.

WebSphere Servers that are shipped with RSDP products:

The various WebSphere Application Server v6.x/7.x servers shipped with Rational Application Developer or Rational Software Architect {for WebSphere} prior to v8.0.4 are only provided as 32 bit editions. As of Rational Application Developer or Rational Software Architect {for WebSphere} v8.0.4+, 64 bit editions of WebSphere Application Server v6.x/7.x servers are shipped in addition to the 32 bit editions.

The WebSphere Application Server v8.x (not beta) server shipped with Rational Application Developer or Rational Software Architect {for WebSphere} v8.0.3+ is provided as one edition, and there is an installation option to install either the 32 bit or 64 bit JVM/JRE (IBM Software Development Kit (SDK)). Any 64 bit edition or 64-bit JVM requires a supported 64 bit operating system. This IBM Education Assistant Module/PDF : IBM WebSphere Application Server V8 Distributed platform installation [http://publib.boulder.ibm.com/infocenter/ieduasst/v1r1m0/topic/com.ibm.iea.was_v8/was/8.0/Installation/WASV8_dist_install.pdf] , demonstrates selecting a 32-bit or 64-bit SDK as part of a WAS v8.0 install using IBM Installation manager. If the WAS v8.0 installation is on a 32-bit operating system, this feature choice between IBM 32-bit SDK Java 6.0 or IBM 64-bit SDK Java 6.0 is not available and the installation will automatically default to the IBM 32-bit SDK Java 6.0.

The shipped WebSphere Portal Server v6.x/7.x servers are 32 bit or 64 bit editions. depending on whether you chose the IBM WebSphere Application Server Network Deployment, 32-bit or 64-bit server to install on.

Note: It is possible to work with any 64 bit remotely accessible or local stand-alone WebSphere Application Server v6.x/7.x/8.x. In Rational Application Developer 8.0.3+ be aware of the Info Center topic: Creating profiles for WebSphere Application Server on a 64-bit machine [Creating%20profiles%20for%20WebSphere%20Application%20Server%20on%20a%2064-bit%20machine] and see this APAR opened against RAD 8.5.1/8.5.5 : PI06339: A 64-bit install of the WebSphere Application Server Profile Management Tool may not launch on Windows 7. RELATED INFORMATION
 Benefits for RSA v8.0.3 products running as 64-bit app [http://www.ibm.com/support/docview.wss?uid=swg27021665]
Internet Explorer v9+ required if using 64-bit Bit Mode [http://www.ibm.com/support/docview.wss?uid=swg21502701]
RAD 8.0.3+ IC: Creating profiles for WAS on a 64-bit ma [http://publib.boulder.ibm.com/infocenter/radhelp/v8/index.jsp?topic=/com.ibm.servertools.doc/topics/rbitmachine.html]
Rational ClearCase SCM adapter not available for 64-bit [http://www.ibm.com/support/docview.wss?uid=swg21502974]
Cannot install the Java Visual Editor in RAD 64 bit [http://www.ibm.com/support/docview.wss?uid=swg21499219]
RAD64bit Known problems to install or run [http://www.ibm.com/support/docview.wss?uid=swg21499482]
WAS V8.0 & V8.5 64-bit Install offer Program Files (x86 [https://developer.ibm.com/answers/questions/175210/why-does-was-v80-and-v85-offer-program-files-x86-a.html]
About SCM Adapter support on 64 Bit [http://www.ibm.com/support/docview.wss?uid=swg21460547]
Conversion of 32 bit to 64 bit WAS on the same machine [http://www.ibm.com/support/docview.wss?uid=swg21625930]
RAD901: Installing RAD for WebSphere Software [http://www-01.ibm.com/support/knowledgecenter/SSRTLW_9.0.1/com.ibm.rad.install.doc/topics/t_install_product.html]
RAD 9.0.x: new features and enhancements-9.0.1-new_OSup [http://www-01.ibm.com/support/docview.wss?uid=swg27038836#whatsnew_901_OSupdates]
RAD 9.0.1 System Requirements - O/S [http://www-969.ibm.com/software/reports/compatibility/clarity-reports/report/html/osForProduct?deliverableId=1374678040873#osFamily-1]
RSA(4WS) 9.0.x: new features and enhancements [http://www.ibm.com/support/docview.wss?uid=swg27038488]
RSA 9.1.2: new features and enhancements - jdk [http://www-01.ibm.com/support/docview.wss?uid=swg27041555#whatsnew_912_JTE]
A simplified Chinese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21504145]

Cross reference information Segment Product Component Platform Version Edition Software Development Rational Software Architect Documentation Linux, Windows 7.0, 7.0.0.1, 7.0.0.2, 7.0.0.3, 7.0.0.4, 7.0.0.5, 7.0.0.6, 7.0.0.7, 7.0.0.8 Software Development Rational Software Modeler Documentation Windows, Linux 7.0, 7.0.0.1, 7.0.0.2, 7.0.0.3, 7.0.0.4 Software Development Rational Systems Developer Documentation Linux, Solaris, Windows 7.0, 7.0.0.1, 7.0.0.2, 7.0.0.3, 7.0.0.4 Software Development Rational Software Architect for WebSphere Software General Information Linux, Windows 7.5, 7.5.1, 7.5.2

Question: Is the Requisite Pro (ReqPro) feature/plugin supported with a 64-bit RAD/RSA(4WS) 851+ installation Is the Requisite Pro (ReqPro) feature/plugin supported with a 64-bit install of RAD/RSA(4WS) 851?

Answer: the Rational RequisitePro integration features/plugins are not supported or provided. These are only available as 32-bit eclipse plugins.


IBM How to overwrite property definition properties in a class via IBM Administration Console for Content Platform Engine (ACCE)? - United States ACCE; CE; Property; FEM TECHNOTE (FAQ)

QUESTION
 With IBM FileNet Enterprise Manager (FEM), we can follow the steps below to overwrite the property definition in a document class

1. Launch FEM
2. Expand the object store and document class tree. Right click on the document class and select "Properties"
3. Go to "Properties Definitions" tab, highlight the property definition and click "Edit"
4. Make the modification and click OK
5. Click OK again to save the change

How to perform the same operation with FileNet Content Engine - ACCE?

ANSWER
Follow the below steps to update the property definition properties on ACCE:

 1. Launch ACCE
 2. Expand the object stores folder and click the object store to open the Object store tab
 3. Expand the Data Design folder and Classes folder. Click the document class to open Document Class tab
 4. From Properties tab, open Property Definitions drop down and select the property definition you want to modify
 5. ACCE will open that property definition in a new Properties tab
 6. Modify the property definition as required
 7. Go back to the Class Definition tab and click Save

Question: Unable to locate the More tab of Document class - Property definition tab - property template configuration to update Is Required setting. Unable to locate the More tab of Document class - Property definition tab - property template configuration to update Is Required setting. Environment is running on Content Engine 5.2.0.3.

Answer:
Follow the below steps to update the property definition properties on ACCE:

 1. Launch ACCE
 2. Expand the object stores folder and click the object store to open the Object store tab
 3. Expand the Data Design folder and Classes folder. Click the document class to open Document Class tab
 4. From Properties tab, open Property Definitions drop down and select the property definition you want to modify
 5. ACCE will open that property definition in a new Properties tab
 6. Modify the property definition as required
 7. Go back to the Class Definition tab and click Save


IBM Starting WebSphere Application Server gives warning message - Could not lock User prefs - United States Websphere; startup; FileSystemPreferences; user prefs; prefs; Could not lock User prefs TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Warning message issued during the non-root or root startup of WebSphere stating that it can not lock the user or system preferences.

SYMPTOM
The following message can be seen in the systemout.log:

[9/11/11 18:03:19:921 EDT] 00000001 prefs W java.util.prefs.FileSystemPreferences syncWorld Couldn't flush user prefs: java.util.prefs.BackingStoreException: Couldn't get file lock.
[9/11/11 18:03:49:929 EDT] 00000001 prefs W java.util.prefs.FileSystemPreferences checkLockFile0ErrorCode Could not lock User prefs. Unix error code 2.

CAUSE
The non-root ID that is being used to start WebSphere Application Server does not have a user_home directory. Therefore this non-root ID is unable to access the root user's "/etc/.java/.systemPrefs". This produces the aforementioned warning messages every 30 seconds in the profile_root/logs/server_name/systemout.log.

The root ID used to start Websphere Application Server can not find the Java system pref file.

DIAGNOSING THE PROBLEM
For non-root, you can confirm this issue by trying to start WebSphere using the "root" ID. Review the Websphere_Home/profiles/<profile_name>/logs/<failing server_name/systemout.log to verify that you no longer see the warning messages.

For root, verify if the /etc/.java/.systemPrefs exists

RESOLVING THE PROBLEM
For non-root :

Create a User_Home directory for this non-root user and restart WebSphere Application Server. If this does not resolve the issue use the following 2 suggestions below :

NOTE : The "dot" in front of the directories below represent that these are "hidden" directories. So the "dot" must be in front of the directory name to go into the directory or to access them.

1. Try giving 755 permission for /home/wasadmin/.java/.userPrefs

2. Add "-Djava.util.prefs.userRoot=/home/wasadmin/preps" as a SDK generic jvm argument

To set the argument on the SDK:

 1. In the administrative console, click Servers > Server Types > WebSphere application servers , and select the server that you want to add the generic argument to..
 2. Then, in the Server Infrastructure section, click Java and process management > Process definition > Java virtual machine.
 3. Specify -Djava.util.prefs.userRoot=/home/wasadmin/preps for the Generic JVM Arguments property, and click OK .
 4. Click Save to save your changes.
 5. Restart the application server.

For root :  1. Create a Java system pref directory
    sudo mkdir -p /etc/.java/.systemPrefs
 2. Restart the application server.

Question:
managesdk.sh -listEnabledProfileAll fails with error: Couldn't get file lock.

I am installing WebGUI FP13 and it is failing with the symptoms described in below technote.

https://www-01.ibm.com/support/docview.wss?uid=swg21993160

As described in above technote when I run managesdk.sh script it fails with below errors.

./managesdk.sh -listEnabledProfileAll

Sep 26, 2018 10:14:12 AM java.util.prefs.FileSystemPreferences syncWorld

WARNING: Couldn't flush user prefs: java.util.prefs.BackingStoreException: Couldn't get file lock.

Please let me know what could be the issue?

Answer:
The non-root ID that is being used to start WebSphere Application Server does not have a user_home directory. Therefore this non-root ID is unable to access the root user's "/etc/.java/.systemPrefs". This produces the aforementioned warning messages every 30 seconds in the profile_root/logs/server_name/systemout.log.

The root ID used to start Websphere Application Server can not find the Java system pref file.


IBM Getting a warning message 'You do not have the correct administrator privileges' when attempting to license a SPSS Statistics product on Mac OS. - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 You have successfully installed an IBM SPSS Statistics product on a Mac computer. When you start the License Authorization Wizard (LAW) to enter the authorization code for licensing.

You receive the following message:

"Warning! You do not have the correct administrator privileges to license this product. Log in as administrator and try again, or contact your network administrator to correct this issue.

"

Once this message is displayed the only option available is "OK" to click on and you cannot enter your authorization code.

RESOLVING THE PROBLEM
Below is a picture of the warning:

[/support/docview.wss?uid=swg21966637&aid=1] [/support/docview.wss?uid=swg21966637&aid=1]

If you encounter this message, perform the following procedure:

 1.  If open, close the IBM SPSS Statistics product.
 2.  If open, close the License Authorization Wizard.
 3.  Open Finder.
 4.  Select the 'Go' menu.
 5.  Select the 'Utilities' menu.
 6.  Open the 'Terminal' program.
 7.  Type (copy/paste) the following command:

     cd /Applications/IBM/SPSS/Statistics/
 8.
 9.  Press Enter/Return.
 10. Perform the procedure corresponding to the Statistics product version as described below:

Statistics Release 20  1. Type (copy/paste) the following command:

    sudo chown -R root:admin 20

 2. Press Enter/Return.
 3. Close Terminal.
 4. Launch the License Authorization Wizard.
 5. The warning message should no longer appear.
 6. License your IBM SPSS Statistics product.

Statistics Release 21  1. Type (copy/paste) the following command:

    sudo chown -R root:admin 21

 2. Press Enter/Return.
 3. Close Terminal.
 4. Launch the License Authorization Wizard.
 5. The warning message should no longer appear.
 6. License your IBM SPSS Statistics product.

Statistics Release 22  1. Type (copy/paste) the following command:

    sudo chown -R root:admin 22

 2. Press Enter/Return.
 3. Close Terminal.
 4. Launch the License Authorization Wizard.
 5. The warning message should no longer appear.
 6. License your IBM SPSS Statistics product.

Statistics Release 23  1. Type (copy/paste) the following command:

    sudo chown -R root:admin 23

 2. Press Enter/Return.
 3. Close Terminal.
 4. Launch the License Authorization Wizard.
 5. The warning message should no longer appear.
 6. License your IBM SPSS Statistics product.

Statistics Release 24  1. Type (copy/paste) the following command:

    sudo chown -R root:admin 24

 2. Press Enter/Return.
 3. Close Terminal.
 4. Launch the License Authorization Wizard.
 5. The warning message should no longer appear.
 6. License your IBM SPSS Statistics product.
 7.
 8.

Statistics Release 25  1. Type (copy/paste) the following command:

    sudo chown -R root:admin 25

 2. Press Enter/Return.
 3. Close Terminal.
 4. Launch the License Authorization Wizard.
 5. The warning message should no longer appear.
 6. License your IBM SPSS Statistics product.

To confirm the changes have been made (1) In the Terminal window change directory to below path (example for release 22)

cd /Applications/IBM/SPSS/Statistics/22/SPSSStatistics.app/Contents

then, type the following:

ls -l

(2) Press Enter/Return.

If you see some or all of subfolders shows a group ownership other than 'admin' (as displayed in Picture1), the procedure did not succeed. You will need to have your Mac IT support contact IBM SPSS Support for further assistance.

Picture1:
[/support/docview.wss?uid=swg21966637&aid=2] [/support/docview.wss?uid=swg21966637&aid=2]

Picture 2:

If you see some or all of subfolders shows a group ownership of 'admin' (as displayed in Picture2), the procedure was successful.
[/support/docview.wss?uid=swg21966637&aid=3] [/support/docview.wss?uid=swg21966637&aid=3]

This behavior is also reported on the following product correction report (APAR): [https://www-304.ibm.com/support/entdocview.wss?uid=swg1PI41134]
[https://www-304.ibm.com/support/entdocview.wss?uid=swg1PI41134]
https://www.ibm.com/support/entdocview.wss?uid=swg1PI41134 [https://www-304.ibm.com/support/entdocview.wss?uid=swg1PI41134]

An IBM ID is required to access this material.

If needed, an IBM ID may be created at https://ibm.biz/ibm_web_id [https://ibm.biz/ibm_web_id]

RELATED INFORMATION
 Need more help? Our Statistics forum is Live! [https://developer.ibm.com/answers/topics/statistics.html?smartspace=predictive-analytics]
Need more help? Our Licensing forum is Live! [https://developer.ibm.com/answers/topics/spsslicensing.html]

Question: Load SPSS 25 on a new computer I purchased SPSS 25 with a 12 month license on Jan 27. I loaded it and used it on my MacBook Pro. I now have a new MacBookPro. I was able to download the program but get a message that says I don't have a license. I do have the activation code. Can you please help me use this product on my new computer? Thanks!

Answer:
Type (copy/paste) the following command:

    sudo chown -R root:admin 20

 2. Press Enter/Return.
 3. Close Terminal.
 4. Launch the License Authorization Wizard.
 5. The warning message should no longer appear.
 6. License your IBM SPSS Statistics product.


IBM Insufficient ulimit Value Causes Native OutOfMemory - United States  TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 An out of memory may be observed on a system running WebSphere Application Server on Linux or AIX that is due to ulimit restrictions on number of process/threads per user. Further investigation may reveal a "Failed to create a thread:" message within the generated javacore which would indicate a native out of memory issue has been encountered. The cause of the problem may be an insufficient ulimit setting. While this type of issue can occur on any level of Linux, or AIX, the issue is most likely to be seen in systems running multiple instances of WebSphere Application Server using one userid. The following will outline how to identify if a process ulimit is the culprit and what WebSphere Application Server Support recommends to fix the case.

SYMPTOM
An out of memory Dump Event such as:

"systhrow" (00040000) Detail "java/lang/OutOfMemoryError"
"Failed to create a thread: retVal -1073741830, errno 11" received

Note: This detailed message will appear only in javacores.

DIAGNOSING THE PROBLEM
When using WebSphere Application Server, ulimits can be set to fix or tune around a number of problems. For more on how to set a ulimit refer to the "Guidelines for setting ulimits [http://www-01.ibm.com/support/docview.wss?uid=swg21469413]" Technote which goes into detail on setting different ulimits on various operating systems and the difference between the soft and hard limit. This article is concerned particularly with the "-u" ulimit or "nproc" limit on Linux, the ulimit - r on AIX which affects the number of threads allowed for a single user process running WebSphere Application Server.

The AIX issue is less commonly seen as it limits then number of threads for a process but is seen in application servers with very large thread pools, This is becoming more common in 64bit addressing JVMs running complex applications. WebSphere Application support recommends setting the ulimit -r ulimited on AIX.

The nproc limit usually only counts processes on a server towards determining this number. Linux systems running WebSphere Application Server are a particular case. The nproc limit on Linux counts the number of threads within all processes that can exist for a given user. To determine the ulimit settings of a WebSphere Application Server process running on Linux refer to "How to determine the ulimit settings of a running WebSphere Application Server process on Linux [http://www-01.ibm.com/support/docview.wss?uid=swg21407889]".

User Limits (in bytes except for NOFILE and NPROC)

type soft limit hard limit RLIMIT_AS unlimited unlimited RLIMIT_CORE unlimited unlimited RLIMIT_CPU unlimited unlimited RLIMIT_DATA unlimited unlimited RLIMIT_FSIZE unlimited unlimited RLIMIT_LOCKS unlimited unlimited RLIMIT_MEMLOCK 65536 65536 RLIMIT_NOFILE 65536 65536 RLIMIT_NPROC 131072 131072

For most cases of older versions of Linux this value will be defaulted to around 2048. For out of the box Red Hat Enterprise Linux (RHEL) 6 the default value for nproc will be set to 1024. This low default setting for larger systems will not allow for enough threads in all processes.

WebSphere Application Server Support recommends setting the ulimit -u or nproc to a value of 131072 when running on Linux to safely account for all the forked threads within processes that could be created.

By using this recommended value a sufficient number of threads in all processes will be allowed and will not be a limiting factor for the environment. Increasing the limit to the suggested value should have no negative impact. When the number of threads in all processes reaches the -u ulimit, an out of memory error message will be thrown. This issue can be avoided by increasing this limit. Be aware that if the number of threads/processes reaches the recommended number of 131072 or close, the issue may be deeper and continuing to increase the -u ulimit will only prove to be a temporary fix.

Once the ulimit is increased, the WebSphere Application Server will need to be restarted to use the
new setting. In the case of WebSphere Application Server ND, the nodeagent and the servers on the nodes will need to be restarted.

Question: Are there any instructions for ulimit settings for WebSphere running on Linux? Are there any instructions for ulimit settings for WebSphere running on Linux?

Answer: WebSphere Application Server Support recommends setting the ulimit -u or nproc to a value of 131072 when running on Linux to safely account for all the forked threads within processes that could be created.


IBM Applying TIP 2.2 fix packs directly to a TIP 2.1 installation - United States TIPL2; TIPL2INST; tivoli Integrated portal; feature pack TECHNOTE (FAQ)

QUESTION
 Can Tivoli Integrated Portal 2.2 fix packs be applied directly to a TIP 2.1 installation?

ANSWER
In order to apply TIP 2.2 fix packs, the target TIP installation must already be at TIPCore 2.2.0 or newer. TIP 2.1 installations must be upgraded to TIP 2.2 using the TIP 2.2.0.1 feature pack. The TIP 2.2.0.1 feature pack can be acquired from IBM Fix Central [http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm~Tivoli&product=ibm/Tivoli/Tivoli+Integrated+Portal&release=All&platform=All&function=all].

The following three items should be obtained from Fix Central:

 * 2.2.0.1-TIV-TIP-<platform>-RP0001
 * 2.2.0.1-TIV-TIP-FITSuit-RP0001vx
 * 2201-fixpack-guide-PDF.pdf

To determine the installed TIPCore version, review the DE listIU command output. Details on the listIU command are included in the following technical note:
http://www-01.ibm.com/support/docview.wss?uid=swg21615989 [http://www-01.ibm.com/support/docview.wss?uid=swg21615989]

Question: Can I apply a TIP 2.2 fix pack directly to a TIP 2.1 installation? Can I apply a TIP 2.2 fix pack directly to a TIP 2.1 installation?

Answer: In order to apply TIP 2.2 fix packs, the target TIP installation must already be at TIPCore 2.2.0 or newer. TIP 2.1 installations must be upgraded to TIP 2.2 using the TIP 2.2.0.1 feature pack.


IBM Problems installing NMA agent  (N4 agent) on Linux x86-64 - United States ITM Virtual environments install NMA N4 unable find bundle prerequisites CI addbundles TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 The installation of NMA agent from package ITM for Virtual Environment V7.2.0.3 is failing with both remote or local installation on Linux x86-64.

SYMPTOM
1) The import of the whole bundle using command:

/opt/IBM/ITM/bin/tacmd addbundles -i <inst_media>/ITMfVE_Agents/unix

will fail with message:

Unable to find bundle prerequisite: ci 06.22.04.000 li6263

--

2) Even if you succeed in importing the bundle, the remote deploy of N4 agent on a Linux X86_64 fails because the installer recognizes the target node as a 64bit while the agent comes with a different architecture (li6263).

--

3) If you try to install the ITM for VE agents locally on a Linux x86_64, the usual installation procedure does not work for the same reason of point 2.
The installer recognizes the target node as a 64bit platform and the agents are 32bit and so it does not show the expected list of agents.

CAUSE
The causes for the three scenarios depends on wrong prerequisite levels packaged into ITM for VE 7.2.0.3 for NMA agent, and on unexpected architecture recognized by the installer when trying to install the agent on the target node, if this one is a Linux x86-64.

RESOLVING THE PROBLEM
The issues should be corrected at Installer level, APAR IV84919 has been opened to fix them.

Anyway, since the correction involves the installation component, it will not be available until next release, when the Installation package will be built again.

Until then, you can bypass the issue with some manual steps.

---------------

1) If the import of agent bundle using command tacmd addbundles fails with message:

Unable to find bundle prerequisite: ci 06.22.04.000 li6263

this occurs because some agents, particularly N4 agent, have old prerequisites for shared components (ax, ui, gs,jr) that are not part of the ITM_for_VE bundle.

There is actually a workaround to correctly import the bundle in the depot, but it will not be of any help because remote installation of N4 agent will then fail due to the problem described in item number 2.

It can be anyway useful to know the workaround as it can be applied to other agents for which remote installation instead correctly works.

You must verify if the prerequisites mentioned in the error message are already present in your depot by using command tacmd viewdepot.
Beside of the one mentioned in the error message, you must be sure that also the other wanted prerequisites are already present in the depot.

N4 agent has the following prerequisites:

Product Code : n4
Deployable : True
Version : 062200000
Description : Monitoring Agent for Network Devices
Host Type : li6263
Host Version : li6263,lx8266
Prerequisites: ci:062204000 la:ipaddr05400 gs:074027000 jr:051201000
ui:062204000 ax:062204000

If all of them are already in the depot, then you can run the tamcd addbundles using flag "-n" (ignore prerequisites), this will allow to correctly import the agent bundle.

If you do not have the wanted prerequisite levels, you have two possible options:

a) retrieve and add them into depot from other ITM installation packages
b) modify the agent dsc files and change the level of the components required by the agent to match the level delivered with the bundle.

For example, ITM for Virtual Environment 7.2.0.3 delivers CI component at level 06.30.05.000, so if we consider N4 agent, you may need to change the file n4li6263.dsc in the rows:

<PrereqProdCode>ci</PrereqProdCode>

<PrereqVersion>

<Version>06</Version>

<Release>22</Release>

<Mod>04</Mod>

<Level>000</Level>

to

<PrereqProdCode>ci</PrereqProdCode>

<PrereqVersion>

<Version>06</Version>

<Release>30</Release>

<Mod>05</Mod>

<Level>000</Level>

The same for other components in case they are also missing from your depot.

The dsc files are into <installation_media>/ITMfVE_Agents/unix folder.

Repeat the tacmd addbundles command and it should now work fine.

As previously said, please consider that this scenario may occur also for agents different than N4, and the workaround is applicable also for them.

Of course the target dsc file name changes accordingly to the agent type and related architecture.

2) The above workaround can help in case the issue is only related to backleveled prerequisite packages.

Anyway, once you applied it, if the target node for the N4 agent is a Linux x86-64, you will anyway not be able to install it remotely.
The remote deploy of N4 agent on a Linux X86_64 fails because the installer recognizes the target node as a 64bit while the agent comes with a different architecture (li6263).
The quickest workaround in this case is to install the agent locally.

3) If you try to install the ITM for VE agents locally on a Linux x86_64, the usual installation procedure does not work for the same reason of point 2.
The installer recognizes the target node as a 64bit platform and the agents are 32bit.
So the installer menu will show no available agents to be installed.

You need to proceed as follow:

a) Run the local installation of N4 agent on target machine and proceed as usual when you are prompted with Installer initial questions.
b) Select Other operating systems when you are showed this panel

[/support/docview.wss?uid=swg21983839&aid=1] [/support/docview.wss?uid=swg21983839&aid=1]

c) Then select Linux Intel R2.6 R3.0 (32 bit)

[/support/docview.wss?uid=swg21983839&aid=2] [/support/docview.wss?uid=swg21983839&aid=2]

d) At this point you will see the list of agents that can be installed on the machine. Select the option for the n4 agent and installation will be completed successfully

[/support/docview.wss?uid=swg21983839&aid=3] [/support/docview.wss?uid=swg21983839&aid=3]

PRODUCT ALIAS/SYNONYM
 IBM Tivoli Monitoring for Virtual Environments V7.2.0.3

Question:
NMA agent installation failure

Hello, I'm trying to install the NMA agent from ITM for Virtual Environment package on a Linux x86-64. The preferred method would be remote install, but I'm not even able to perform tamcd addbundles as it complains about missing prerequisites.

If I try to install the agent locally on the Linux machine, the list of available agents does not include NMA agent at all.

Is there a solution to this problem?

Answer:
The issues should be corrected at Installer level, APAR IV84919 has been opened to fix them.

Anyway, since the correction involves the installation component, it will not be available until next release, when the Installation package will be built again.


IBM Action required for IBM Integration Bus Hypervisor Edition V9.0 and WebSphere Message Broker Hypervisor Edition V8.0 for security vulnerabilities in Red Hat Linux - United States  FLASH (ALERT)

ABSTRACT
 IBM Integration Bus Hypervisor Edition V9.0 and WebSphere Message Broker Hypervisor Edition V8.0 require customer action for security vulnerabilities in Red Hat Linux.

CONTENT
IBM Integration Bus Hypervisor Edition V9.0 and WebSphere Message Broker Hypervisor Edition V8.0 ship with versions of Red Hat Enterprise Linux (RHEL) Server that are vulnerable to CVE-2016-2126, CVE-2016-2125, CVE-2016-2123, CVE-2016-8866, CVE-2016-9556, CVE-2016-9559, and CVE-2016-9773.

IBM Integration Bus Hypervisor Edition V9.0 and WebSphere Message Broker Hypervisor Edition V8.0 ship with Red Hat Enterprise Linux (RHEL) Server 6.2.

Remediation:

IBM strongly recommends that you contact Red Hat to obtain and install fixes for Red Hat Enterprise Linux (RHEL) Server 6.2, as applicable.

Cross reference information Segment Product Component Platform Version Edition Business Integration WebSphere Message Broker Hypervisor Edition Linux 8.0
PRODUCT ALIAS/SYNONYM
 WMB HVE IIB HVE

Question:
Help with Action required for IIB V9 & WMB V8 Hypervisor Editions  for security vulnerabilities in Red Hat Linux

I need to understand details regarding Action required for IBM Integration Bus Hypervisor Edition V9.0 and WebSphere Message Broker Hypervisor Edition V8.0 for security vulnerabilities in Red Hat Linux.

Where can I find this information?

Answer: WebSphere Message Broker Hypervisor Edition


IBM Guidelines for setting ulimits (WebSphere Application Server) - United States ulimits; linux; unix; aix; openfiles; opensockets; sockets; socket; files; ulimit-n; limits.conf; configuration; security; etc; root; init; crontask; cron; nodeagent; dmgr; appserver; server; applicationserver; application; nofile; unlimited; 8000; 8192 TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 This document describes various ways to set ulimit values on UNIX and Linux operating systems as well as information that pertains to WebSphere Application Server

SYMPTOM
Tuning ulimits correctly can overcome these errors:

 * Too Many Open Files
 * Could not lock User prefs. Unix Error Code 24.
 * Truncated Core Dumps / Heap Dumps

RESOLVING THE PROBLEM

Is it possible to display the current ulimit settings? The command ulimit -Xa will display all current settings that are set for the current login session, where X represents the hard (H) or soft (S) limits to be displayed. By default, if no value is supplied for X, soft limits will be displayed. However if a process is already running, it may have a different ulimit configurations than the current shell that you run the ulimit -a command in.

How are ulimts set? Soft vs. Hard limits Soft limits are the current setting for a particular limit. They can be increased only to the current hard limit setting.

Hard limits are the maximum limit that can be configured. Any changes to these require root access.

Temporary Settings (for current session)

 *
 * ulimit -[H|S]limit_name limit_value

Temporary settings are set via the command line using the ulimit command. The limit_name must be present in the command (see the chart below). These settings are only temporary for the current session and will be lost once the session is over or the terminal window is closed.

This syntax can be used within shell scripts. Any processes spawned from these shell scripts will also have the temporary settings for the lifetime they are running.

By default, the soft limit will be changed (as changing the hard limit needs root access). Use -H (for hard limits) or -S (for soft limits) to change specific hard or soft limits.

NOTES:

On HP-UX, if you receive an error when setting a particular limit, and you have altered that particular hard limit, you may need to check and see if it had exceeded the kernel parameters. You can use kctune to check (and alter) these if necessary; check your HP-UX documentation for more information.

For Solaris, settings in the "/etc/system" configuration file also allow configuring of some kernel-wide limits.

Global Settings

[/support/docview.wss?uid=swg21469413&aid=1] Any changes to these global configuration limits files should be performed by your system administrator. Instructions on how to edit the files can be found on the manpage or in the commented section of the configuration file, as they can vary between versions of UNIX or Linux.

The format of the file, which differs slightly on versions of AIX and Linux, allows individual limits per users or groups, as well as set hard and soft limits. The limits defined in this configuration file are set globally.

Changes made to any limits file take effect after launching a new login shell (such as bash -l), or if the user logs out and logs back in to the system.

NOTES:

On Solaris and HP-UX, changes made to your shell's profile configuration (.profile or .login) should also take effect on the next login shell launched, or when your user logs back in using the specific shell.

For kernel-wide settings, which usually require a restart of the operating system to take effect, HP-UX has the kctune command, while Solaris has the /etc/system configuration file.

Specifics for each Operating System:
The most up-to-date information on the limits can be found in the man page for "ulimit".

AIX
Global settings are generally set in the file /etc/security/limits, although there may be different limit files for LPARs and WPARs.

Please note that this table may not represent all ulimit items as they can vary between operating system versions. Consult the ulimit man page or the limits file for further information.

Command Line limit_name * /etc/security/limits Description ulimit -c [value] core
core_hard Core file size in 512 byte blocks. ulimit -d [value]
(K bytes) data
data_hard Data segment size of processes in kilobytes. ulimit -f [value] fsize
fsize_hard File size limit in 512 byes blocks. ulimit -n [value] nofiles
nofiles_hard Max number of open files and/or sockets per process. ulimit -m [value]
(K bytes) rss
rss_hard The memory size of the process in kilobytes. ulimit -r [value] threads
threads_hard Max number of threads per process. ulimit -s [value]
(K bytes) stack
stack_hard The stack segment size in kilobytes. ulimit -t [value]
(seconds) cpu
cpu_hard Max per process CPU time (in seconds). ulimit -u [value] nproc
nproc_hard Specifies the limit of the number of processes per user. * Values are in 512 byte blocks unless otherwise specified, check your man page for further information

HP-UX

There is no global settings file on HP-UX. Instead, you would need to issue the specific ulimit command in your shell's (or user's) profile configuration (like .profile or .login).

There are similar kernel settings you can also set with kctune, such as "maxfiles_lim", but these kernel parameters do not normally need to be changed. Please refer to its man page for further information.
Please note that this table may not represent all ulimit items as they can vary between operating system versions. Consult the ulimit man page or your OS documentation for further information.

Command "ulimit" limit_name* Description ulimit -c [value] Core file size in 512 byte blocks. ulimit -d [value] Data segment size of processes in 512 byte blocks. ulimit -f [value] File size limit in 512 byes blocks. ulimit -n [value] Max number of open files and/or sockets per process. ulimit -m [value] The memory size of the process in 512 byte blocks. ulimit -s [value] The stack segment size in 512 byte blocks. ulimit -t [value]
(seconds) Max per process CPU time (in seconds). * Values are in 512 byte blocks unless otherwise specified, check your man page for further information.

Linux
Global settings are set in the file /etc/security/limits.conf.

The format for setting each limit is as follows:
<domain> <type> <item> <value>

<domain> controls which users or groups will have these limits

<type> is either the string "soft" or "hard" limits.
The hyphen "-" can also be used which represents both soft and hard limits

<item> and <value> are shown in the table below. Most values can also use the string unlimited.

Please note that this table may not represent all ulimit items as they can vary between Linux variants. Consult the ulimit man page or the limits.conf file for further information.

Command Line limit_name /etc/security/limits.conf <item> Description ulimit -c [value] core Max core dump file size (KB) ulimit -d [value] data Max data size (KB) ulimit -f [value] fsize Max file size (KB) ulimit -l [value] memlock Max size of address space that can be locked into memory (KB) ulimit -n [value] nofile Max number of open files/sockets per process** ulimit -u [value] nproc Max number of processes for a single user ulimit -m [value] rss Max resident set size (KB) ulimit -s [value] stack The maximum stack size (KB) ulimit -t [value] cpu Max CPU time (minutes or seconds) ** There is a restriction that occurs on Red Hat Enterprise Linux that this value cannot be set to unlimited

Solaris

There is no global settings file specifically for ulimits on Solaris (however you can set kernel-wide settings in the /etc/system file). Instead, you would need to issue the specific ulimit command in your shell's (or user's) profile configuration (like .profile or .login).

Also depending on the shell used, the ulimit command is slightly different. See the man page for further information.

You can also set kernel wide settings for many of these ulimits in the /etc/system file.
For example, "set lim_fd_max = [value]" and "set rlim_fd_cur = [value]" are respectively the global hard and soft file descriptor limits. See the system OS's documentation for information on the /etc/system file.
Please note that this table may not represent all ulimit items as they can vary between operating system versions. Consult the ulimit man page or your OS documentation for further information.

Command Line limit_name *
(sh, ksh, bash) Command Line
(csh) Description ulimit -c [value] ulimit coredumpsize [value]
(K bytes) Core file size in 512 byte blocks. ulimit -d [value]
(K bytes) ulimit datasize [value]
(K bytes) Data segment size of processes in kilobytes. ulimit -f [value] ulimit filesize [value]
(K bytes) File size limit in 512 byes blocks. ulimit -n [value] ulimit descriptors [value] Max number of open files and/or sockets per process (plus 1) ulimit -s [value]
(K bytes) ulimit stacksize [value]
(K bytes) The stack segment size in kilobytes. ulimit -t [value]
(seconds) ulimit cputime [value]
(seconds) Max per process CPU time (in seconds). ulimit -v [value]
(K bytes) ulimit memorysize [value]
(K bytes) Maximum size of virtual memory (in kilobytes) * Values are in 512 byte blocks unless otherwise specified, check your man page for further information.

If I am experiencing Too Many Open Files (Unix Error Code 24), can I increase the number of file descriptors?
Yes you can through the ulimit -n [value] command. However these settings won't take effect until you restart your application server (and nodeagent), making sure you restart on the same command line where you executed "ulimit -n".

However, if you increase the value high enough and still run into these errors, you may want to check for a file descriptor leak (meaning a leak of opened files and/or sockets in your application code). The command lsof, offered on a variety of operating systems, can provide information on the quantity and types of file descriptors in use.

Further information can be found at this link: Too Many Open Files error message [http://www.ibm.com/support/docview.wss?uid=swg21067352]

On Linux, can I set the ulimit for the number of open files to unlimited? Certain versions of Red Hat Enterprise Linux do not allow this value to be set to unlimited due to a known issue in Red Hat Enterprise Linux 5 [https://bugzilla.redhat.com/show_bug.cgi?id=507159]. The limit must be set to an integer value no larger than 1048576. Other versions of Linux may not have this restriction. In the Information Center for WebSphere Application Server, there is a recommendation [http://www.ibm.com/support/knowledgecenter/en/SSAW57_8.0.0/com.ibm.websphere.nd.doc/info/ae/ae/tprf_tunelinux.html] of 8000.

If an attempt is made to set this ulimit to unlimited via the command line, an error will be displayed, and the old value will remain in place:
[root] # ulimit -n unlimited
bash: ulimit: open files: cannot modify limit: Operation not permitted

[/support/docview.wss?uid=swg21469413&aid=2] If you try to edit the /etc/security/limits.conf file to force unlimited for the number of open files, this will still be considered invalid and it will be reset to 0. This will prevent any new processes from spawning by that user or group. If this is the root user, the system will slowly die as new processes will be unable to generate. A recovery disc will be needed to reset the value.

On Red Hat Enterprise Linux 6, why are my settings for nproc (ulimit -u) not being honored. Red Hat Enterprise Linux 6 has introduced a configuration file, addressed in a bug report [https://bugzilla.redhat.com/show_bug.cgi?id=919793], ( /etc/security/limits.d/90-nproc.conf ) that overrides the nproc setting in the limits.conf. This file contains a line for nproc configured with a soft limit of 1024.

* soft nproc 1024

The rationale for this was to prevent fork bombs from occurring, To keep using the limits.conf for your nproc ulimit settings, you would need to comment this line out by making the first character on the line a hash/pound symbol.

#* soft nproc 1024

I am using an /etc/init.d script (or inittab) to start my application server and setting the global ulimit settings had no effect? The global settings for ulimit will not take effect if the init process starts the application server or nodeagent because it has yet to load the global settings. The global settings take effect once a login terminal session is started, or when a user logs in to the system, not when the init process spawns new processes based on init.d scripts. At startup, the operating system hasn't begun to load specific profiles up, even the root user. When you see individual services and processes starting, these are all child processes of the init process

This was previously documented for AIX 6.1 in the following Knowledge Center article entitled "telinit or init Command", under the Environments section. Here's the quoted section:

"A command that is executed by init from the /etc/inittab file uses init's ulimit values and not the default values as given in /etc/security/limits. The result is that a command that is successfully executed from the command line may not execute correctly when invoked by init. Any command that has specific ulimit requirements should include specific actions to set the ulimit values as required."

RELATED INFORMATION
 Domino for Linux (see step 2) [http://www.ibm.com/support/docview.wss?rs=0&uid=swg21377724]
AIX - IBM SDK 7.0 User Guide - Ulimits [http://publib.boulder.ibm.com/infocenter/java7sdk/v7r0/index.jsp?topic=%2Fcom.ibm.java.aix.70.doc%2Fuser%2Fulimits.html]
Linux - IBM SDK 7.0 User Guide - Ulimits [http://publib.boulder.ibm.com/infocenter/java7sdk/v7r0/index.jsp?topic=%2Fcom.ibm.java.lnx.70.doc%2Fuser%2Fulimits.html]

Question: What can be done about "Too many open files" messages in the DASH systemOut? What can be done about "Too many open files" messages in the DASH systemOut log?

Answer: The command ulimit -Xa will display all current settings that are set for the current login session, where X represents the hard (H) or soft (S) limits to be displayed. By default, if no value is supplied for X, soft limits will be displayed. However if a process is already running, it may have a different ulimit configurations than the current shell that you run the ulimit -a command in.